[BSidesSF2020]decrypto-2

encrypt

import hashlib
import struct
import sys


class Crypto:

    def __init__(self, key):
        if not isinstance(key, bytes):
            raise TypeError('key must be of type bytes!')
        self.key = key
        self._buf = bytes()
        self._out = open("/dev/stdout", "wb")

    def _extend_buf(self):
        self._buf += self.key

    def get_bytes(self, nbytes):
        while len(self._buf) < nbytes:
            self._extend_buf()
        ret, self._buf = self._buf[:nbytes], self._buf[nbytes:]
        return ret

    def encrypt(self, buf):
        if not isinstance(buf, bytes):
            raise TypeError('buf must be of type bytes!')
        stream = self.get_bytes(len(buf))
        return bytes(a ^ b for a, b in zip(buf, stream))

    def set_outfile(self, fname):
        self._out = open(fname, "wb")

    def encrypt_file(self, fname):
        buf = open(fname, "rb").read()
        self._out.write(self.encrypt(buf))


class HashCrypto(Crypto):

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self._blk = self.key
        self._blkid = 0

    def _extend_buf(self):
        self._blk = hashlib.sha256(
                self._blk + struct.pack('<I', self._blkid)).digest()
        self._blkid += 1
        self._buf += self._blk


def main(argv):
    if len(argv) not in (3, 4):
        print("%s <key> <infile> [outfile]" % sys.argv[0])
        return
    argv.pop(0)
    key = argv.pop(0)
    inf = argv.pop(0)
    crypter = HashCrypto(key.encode("utf-8"))
    if sys.argv:
        crypter.set_outfile(argv.pop(0))
    crypter.encrypt_file(inf)


if __name__ == '__main__':
    main(sys.argv)

decrypt

通过代码审计,如果我们知道stream的前32位,那么就可以推出答案了,观察到密文是svg文件加密而来,那么svg的前32位我们就可以由一般的svg格式来推出来了.这样stream的前32位也就出来了.

s=b'<?xml version="1.0" encoding="UTF-8" standalone="no"?>'
f=open('flag.svg.enc','rb').read()
import hashlib
import struct
sha0=bytes()
x1=bytes(a^b for a,b in zip(s[:32],f[:32]))
sha0+=x1
temp=1
for i in range(200):
    x1=hashlib.sha256(x1+struct.pack('<I',temp)).digest()
    sha0+=x1
    temp+=1
flag=bytes(a^b for a,b in zip(sha0,f))
print(flag)

#CTF{but_even_I_couldnt_break_IT}